What are GraphQL tokens in the context of max-tokens?

[gajus]

Is that just the number of characters in the GraphQL request?

[nullswan]

This is not the number of characters.

Token are emitted by the GraphQL JS lexer.
See https://github.com/graphql/graphql-js/blob/9c90a23dd430ba7b9db3d566b084e9f66aded346/src/language/tokenKind.ts#L5